Add preparations for the new location for secureboot keys.

nix/configuration/roles/boot/default.nix

@@ -75,11 +75,15 @@
       boot.lanzaboote = {
         enable = true;
         pkiBundle = "/etc/secureboot";
+        # TODO:
+        #     pkiBundle = "/var/lib/sbctl";
       };
       environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
         hideMounts = true;
         directories = [
-          "/etc/secureboot" # Secure Boot Keys
+          "/etc/secureboot" # Old Secure Boot Keys location
+          # TODO: run `doas sbctl setup --migrate` to move keys
+          "/var/lib/sbctl" # Secure Boot Keys
         ];
       };
     })

nix/configuration/roles/docker/default.nix

@@ -9,10 +9,15 @@
   imports = [ ];
 
   virtualisation.docker.enable = true;
-  virtualisation.docker.rootless = {
+  # Use docker activation
-    enable = true;
+  virtualisation.docker.enableOnBoot = false;
-    setSocketVariable = true;
+  # Rootless docker breaks access to ssh for buildkit.
-  };
+  # virtualisation.docker.rootless = {
+  #   enable = true;
+  #   setSocketVariable = true;
+  # };
+  # Give docker access to ssh for fetching repos with buildkit.
+  virtualisation.docker.extraPackages = [ pkgs.openssh ];
   environment.systemPackages = with pkgs; [
     docker-buildx
   ];
@@ -27,16 +32,18 @@
         mode = "0740";
       }
     ];
-    users.talexander = {
+    # users.talexander = {
-      directories = [
+    #   directories = [
-        {
+    #     {
-          directory = ".local/share/docker";
+    #       directory = ".local/share/docker";
-          user = "talexander";
+    #       user = "talexander";
-          group = "talexander";
+    #       group = "talexander";
-          mode = "0740";
+    #       mode = "0740";
-        }
+    #     }
-      ];
+    #   ];
-    };
+    # };
   };
 
+  # Needed for non-rootless docker
+  users.users.talexander.extraGroups = [ "docker" ];
 }